Privacy Policy — to138

Throughout this Privacy Policy, the following terms carry the meanings assigned to them below:

• "to138", "we", "us", or "our" refers to the operator of the online betting and gaming platform accessible at https://to138.vip and all associated subdomains and interfaces.
• "Platform" means the to138 website, mobile-optimised site, and any related API or software service through which Members access the Services.
• "Member" or "you" means any natural person who has registered a to138 Account or who visits the Platform without registering.
• "Personal Data" means any information that identifies or could reasonably be used to identify you as an individual, including but not limited to your name, national identity number, email address, device identifiers, and financial account details.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, and deletion.
• "KYC" means Know Your Customer — the identity and document verification process to138 uses to confirm a Member's identity before enabling withdrawals and certain account features.
• "Third-Party Processor" means any external company that processes Personal Data on to138's behalf under a binding data processing agreement, including but not limited to payment processors, identity verification providers, and game studios.
• "IDR" means Indonesian Rupiah, the transaction currency of the Platform.
• "WIB" means Western Indonesia Time (UTC+7), the reference time zone for all operational and data-related timeframes unless otherwise stated.

to138 collects Personal Data across several categories, depending on how you interact with the Platform. The table below summarises the categories of data we collect and the primary purpose for which each category is collected.

to138 collects Personal Data through the following channels and mechanisms:

• Directly from you: When you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact the support team, or respond to a promotional offer.
• Automatically via the Platform: When you visit or use the Platform, our servers and analytics tools automatically collect Technical Data and Usage Data through cookies, web beacons, and similar tracking technologies. See Section 7 (Cookies & Tracking) for full details.
• From Third-Party Processors: Payment processors confirm transaction status and flag suspicious transactions; identity verification providers return KYC match scores and document authenticity results; fraud detection services share device risk signals.
• From publicly available sources: In limited cases and only where permitted by applicable law, to138 may supplement your profile with data from publicly available sources — for example, cross-referencing a name against publicly available sanctions or politically exposed persons (PEP) lists as required by our AML obligations.

to138 processes Personal Data only where a valid lawful basis exists under internationally recognised data protection frameworks. The lawful bases we rely on are:

• Contract Performance: Processing that is necessary to open and operate your Account, process deposits and withdrawals, settle bets, and provide the Services you have requested.
• Legal Obligation: Processing required to comply with our international licensing conditions, anti-money-laundering regulations, know-your-customer requirements, and other applicable legal obligations. This includes retaining transaction records for a minimum of five years.
• Legitimate Interests: Processing necessary for to138's legitimate business interests — such as fraud prevention, platform security, duplicate account detection, and internal analytics — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for which you have provided a clear, freely given, specific, and informed consent — most notably for receiving promotional and marketing communications. You may withdraw this consent at any time without affecting any other processing.

to138 uses Personal Data collected from Members for the following purposes:

1. Account Creation and Management: Setting up and maintaining your to138 Account, authenticating your identity at login, and enabling you to access all Services available on the Platform.
2. Transaction Processing: Receiving deposits and processing withdrawal requests through your selected payment channel — whether via local Indonesian banks (BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, BSI, Bank Permata) or e-wallets (OVO, DANA, GoPay, ShopeePay, LinkAja).
3. Identity Verification (KYC): Confirming that you meet the eligibility requirements to use the Platform — most critically, that you are at least 21 years of age and a resident of Indonesia — and verifying the source of funds where required by our AML obligations.
4. Fraud and Security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, money laundering, match-fixing, and other misuse of the Platform. This includes automated risk scoring of transactions and device fingerprint analysis.
5. Responsible Gaming: Monitoring usage patterns to identify potential signs of problem gambling behaviour, in order to trigger timely interventions such as displaying responsible gaming prompts or flagging accounts for welfare review in accordance with our Responsible Gaming Policy.
6. Customer Support: Handling your enquiries, resolving disputes, processing complaints, and maintaining records of support interactions for quality assurance and legal compliance.
7. Marketing Communications (with consent only): Sending you personalised promotional offers, bonus notifications, and event-based campaigns — such as BRI Liga 1 season promotions, Idul Fitri special bonuses, or Champions League free-bet offers — where you have explicitly opted in to receive such communications.
8. Platform Improvement: Analysing aggregated and anonymised Usage Data to understand how Members interact with the Platform, identify areas for improvement, and develop new features and game categories.
9. Legal and Regulatory Compliance: Meeting our obligations under our international operating licence, cooperating with licensed regulators and law enforcement agencies as required by law, and maintaining records that may be required in the event of a legal dispute.

to138 does not sell your Personal Data. We share Personal Data only in the following limited and controlled circumstances:

• Payment Processors: Your financial data (bank account number, transaction amounts, payment channel identifiers) is shared with licensed payment processors solely for the purpose of executing deposit and withdrawal transactions. All processors are bound by confidentiality obligations and may not use your data for any other purpose.
• Identity Verification Providers: KYC document data is transmitted to our contracted identity verification service for automated document authenticity checks and facial comparison. These providers operate under strict data processing agreements and are prohibited from retaining or re-using your documents.
• Licensed Game Studios: Where certain games are provided by third-party studios (such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Pocket Games Soft, or Spribe), limited Technical and Usage Data may be shared with that studio solely to facilitate game delivery, session management, and RNG certification. No Identity or Financial Data is shared with game studios.
• Fraud and Risk Intelligence Services: Anonymised device and behavioural signals may be shared with specialised fraud detection services to improve Platform-wide security. These services receive no directly identifying information.
• Regulatory and Law Enforcement Authorities: to138 will disclose Personal Data to regulators, law enforcement agencies, or courts where required by a valid legal process, court order, or applicable law. We will notify you of such disclosures where permitted to do so.
• Group Companies and Successors: In the event of a merger, acquisition, or sale of all or part of the to138 business, your Personal Data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy. You will be notified of any such transfer in advance.

to138 uses cookies and similar tracking technologies to operate the Platform, remember your session, and — where you have given consent — to deliver personalised content and measure the effectiveness of promotions. The types of cookies we use are described below.

You can manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies may prevent you from logging in or using core platform features. to138 does not use third-party advertising networks or retargeting pixels.

to138 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, and in all cases for no longer than required by our licensing obligations and applicable law. The retention schedule below applies to standard Member accounts. Where a legal hold is in place (for example, due to an ongoing investigation or litigation), data may be retained beyond the standard period until the hold is lifted.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction of individual identities. Anonymised, aggregated data may be retained indefinitely for statistical and product development purposes.

to138 implements a layered security architecture designed to protect your Personal Data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• Transport Security: All data in transit between your browser and our servers is encrypted using TLS 1.2 or higher. Our SSL certificate is maintained by a trusted certificate authority and is renewed continuously.
• Data Encryption at Rest: Sensitive data fields — including financial account identifiers and KYC document files — are encrypted at rest using AES-256 encryption. Encryption keys are managed through a dedicated key management system separate from the data storage layer.
• Access Controls: Access to Personal Data within to138 is restricted on a strict need-to-know basis. Employees and contractors with access to sensitive data are subject to role-based access controls, multi-factor authentication requirements, and regular access reviews. Former employees' access is revoked immediately upon termination of employment.
• Penetration Testing: to138 conducts regular third-party penetration testing and vulnerability assessments of the Platform infrastructure to identify and remediate security weaknesses before they can be exploited.
• Incident Response: to138 maintains a documented data breach response plan. In the event of a confirmed breach that poses a risk to your Personal Data, we will notify affected Members and relevant authorities within the timeframe required by our licensing obligations.
• Employee Training: All to138 staff who handle Personal Data receive mandatory data protection and security awareness training at onboarding and on an annual basis thereafter.

As a to138 Member, you hold the following rights in relation to your Personal Data. These rights may be exercised free of charge by contacting the to138 Data Protection team at the email address listed in Section 14.

• Right of Access: You may request a copy of all Personal Data that to138 holds about you, along with information about how it is being used, where it was obtained from, and who it has been shared with. We will respond within 30 calendar days.
• Right to Rectification: If any Personal Data we hold about you is inaccurate or incomplete, you may request that it be corrected or completed. Corrections to KYC data may require you to resubmit supporting documents.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your Personal Data where: (a) it is no longer necessary for the purpose it was collected; (b) you withdraw consent and no other lawful basis applies; or (c) processing was unlawful. This right does not apply where we are legally required to retain the data (e.g., AML record-keeping obligations).
• Right to Restriction: You may request that we restrict processing of your data while the accuracy of data is being contested, or while a complaint or legal claim is pending.
• Right to Data Portability: You may request a structured, machine-readable copy of the Personal Data you have provided to us, where the processing is based on consent or contract performance.
• Right to Object: You may object to processing based on legitimate interests — including profiling for responsible gaming monitoring. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time without penalty. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

to138 is strictly an adults-only platform. Access to the Platform and its Services is permitted only to individuals who are 21 years of age or older. to138 does not knowingly collect Personal Data from individuals under the age of 21.

During registration, you are required to confirm that you are at least 21 years old. KYC verification independently validates your date of birth against government-issued identity documents. Any Account found to belong to a person under 21 will be closed immediately, all associated funds will be forfeited, and the matter may be escalated to relevant authorities.

If you are the parent or guardian of a minor and believe that your child has accessed the to138 Platform and submitted Personal Data, please contact us immediately at [email protected]. We will take prompt action to locate and permanently delete that data.

to138 operates as an internationally licensed platform, and some of our Third-Party Processors are located in jurisdictions outside Indonesia. Where Personal Data is transferred to a country that does not provide an equivalent level of data protection to that applicable in Indonesia, we ensure that appropriate safeguards are in place, including:

• Contractual clauses in our Data Processing Agreements that require the recipient to apply data protection standards equivalent to those described in this policy.
• Where possible, anonymisation or pseudonymisation of data prior to transfer so that the transferred data cannot on its own be used to identify you.
• Conducting due diligence on the security practices of all Third-Party Processors before engaging their services and conducting periodic reviews thereafter.

By creating an Account on to138, you acknowledge that your Personal Data may be transferred to, and processed in, countries outside Indonesia for the purposes described in this policy, and that to138 will take the safeguards described above to protect your data during any such transfer.

to138 reviews and updates this Privacy Policy periodically to reflect changes in our data practices, Platform features, legal obligations, and regulatory guidance. The date of the most recent update is displayed at the top of this page.

When we make material changes to this policy — changes that meaningfully affect how we collect, use, or share your Personal Data — we will notify you by email to your registered address at least 14 days before the changes take effect. We may also display a prominent notice on the Platform login screen. For non-material clarifications or formatting changes, we may update the policy without advance notice.

Your continued use of the Platform after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you may close your Account at any time by contacting the to138 support team before the effective date.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights as described in Section 10, or wish to raise a concern about how your Personal Data has been handled, please contact the to138 Data Protection team:

to138 takes all privacy complaints seriously. If you submit a complaint and are not satisfied with our response, you have the right to escalate the matter to the relevant data protection authority or licensing regulator in the jurisdiction under which to138 operates.

We are committed to working with you constructively to resolve any concerns about your Personal Data. Our support team includes Indonesian-speaking agents available 24 hours a day, 7 days a week, who can assist you in navigating the data rights process.